Insights and research on cybersecurity, threat intelligence, and infrastructure protection.
Oasis Security identified and analyzed a large-scale intrusion campaign targeting Tunisian government entities and a French healthcare company, involving SQL injection exploitation, database dumping, web shell deployment, and internal network propagation.
Oasis Security identified an active SQL injection campaign, resulting in confirmed data exfiltration from multiple enterprise websites, including a global payment service provider.
Oasis Security identified a dark web service offering active Western Union MTCN transaction identifiers, hosted on infrastructure also linked to a Bitcoin mixing operation.
Oasis Security identified a widespread automated intrusion campaign leveraging SQL injection and obfuscated PHP web shells to compromise government, educational, and commercial websites across multiple countries, resulting in large-scale data exfiltration and exposure of approximately 28 million browser-stored credentials.
Oasis Security identified exposed backend infrastructure supporting both a financial data marketplace and a drug trafficking platform on the dark web, revealing a shared public IP address and operational overlap between distinct illicit services.
Oasis Security identified multiple active exploitation operations involving Oracle E-Business Suite RCE, React2Shell-based REC, and large-scale WordPress credential harvesting, based on attacker-side artifacts that confirm successful intrusion and post-exploitation activity.
Oasis Security identified a targeted intrusion operation involving prior internal network access, credential abuse, and automated data exfiltration affecting multiple websites referencing Vietnam Post operations.
Oasis Security uncovered a publicly exposed backend IP linked to the Cash God dark web site, revealing weaknesses in its intended anonymity controls.
Oasis Security uncovered multiple real-world intrusions abusing Magento CVE-2025-54236, demonstrating how the vulnerability is being leveraged for both mass root-level compromise and targeted web shell attacks across different regions.
Oasis Security provides an in-depth analysis of AKIRA ransomware’s dark web extortion infrastructure, highlighting public IP exposure and recurring backend configuration patterns despite frequent infrastructure rotation.
Oasis Security identified and analyzed a coordinated intrusion campaign spanning Brazil, Guinea, and the United States, revealing confirmed internal network compromises and deliberate post-exploitation activity rather than opportunistic scanning.
Oasis Security identified a large-scale automated scanning and exploitation campaign targeting Israeli and global government infrastructure by abusing recently disclosed React vulnerabilities.
Oasis Security researchers identified two separate compromise incidents—targeting an Indian university and a Cambodian government agency—both leveraging the same SQL injection exploitation technique.
We're preparing new research and practical guides—stay tuned for the next blog release.